The 'teate-thy-sonic-burne' npm package version 6.9.9 is involved in a malicious campaign linked to the tea.xyz token reward system. It contains autopublish scripts (such as auto.js and autopublish.js variants) that automate the creation and publication of derivative packages with randomized Indonesian-themed or English names. These scripts alter package.json by removing private flags and changing version numbers to enable continuous republishing. This behavior inflates developer reputation scores fraudulently and results in widespread pollution of the npm registry with numerous derivative packages.

The malicious package enables automated generation and publication of numerous derivative npm packages, which can inflate developer reputation scores fraudulently within the tea protocol token reward system. This activity pollutes the npm registry with many variants, potentially undermining trust in the ecosystem and complicating package management and security assessments. There is no indication of direct code execution or data compromise from this package alone.

No official patch or remediation is currently documented for this package. Users should avoid installing or depending on 'teate-thy-sonic-burne' version 6.9.9 and related derivative packages. Registry maintainers and security teams should monitor for and remove such autopublished malicious packages to prevent ecosystem pollution. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.